{"actor": {"id": "00ugb1l5ixnPE9vW45d7", "type": "User", "alternateId": "victim@gmail.com", "displayName": "SFA Test", "detailEntry": null}, "client": {"userAgent": {"rawUserAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36", "os": "Mac OS 13.6.6 (Ventura)", "browser": "CHROME"}, "zone": "null", "device": "Computer", "id": null, "ipAddress": "66.66.66.66", "geographicalContext": {"city": "Oakland", "state": "California", "country": "United States", "postalCode": "94602", "geolocation": {"lat": 37.8043, "lon": -122.2156}}}, "device": null, "authenticationContext": {"authenticationProvider": "FACTOR_PROVIDER", "credentialProvider": "OKTA_CREDENTIAL_PROVIDER", "credentialType": null, "issuer": null, "interface": null, "authenticationStep": 0, "externalSessionId": "idxFVwNO2HkT-yxlYeUrsrSyw"}, "displayMessage": "Authentication of user via MFA", "eventType": "user.authentication.auth_via_mfa", "outcome": {"result": "SUCCESS", "reason": null}, "published": "2024-04-08T22:38:57.054Z", "securityContext": {"asNumber": 46375, "asOrg": "tonic.net  llc", "isp": "tonic telecom llc", "domain": "tonic.net", "isProxy": false}, "severity": "INFO", "debugContext": {"debugData": {"authnRequestId": "a90f042f089b2ffe1ca5f998b41a755d", "deviceFingerprint": "d4506d714e932f03e13f6a39a6933038", "requestId": "18ee6cbee033b66afdf2d8b13796c0a8", "authenticatorMethodChallengeTime": "2024-04-08T22:38:49.004Z", "dtHash": "5a60c5862cb128432dca3ac69c1b896d47690b9891501bf68f059647f4bda318", "requestUri": "/idp/idx/identify", "threatSuspected": "false", "factor": "PASSWORD_AS_FACTOR", "factorIntent": "AUTHENTICATION", "url": "/idp/idx/identify?"}}, "legacyEventType": "core.user.factor.attempt_success", "transaction": {"type": "WEB", "id": "18ee6cbee033b66afdf2d8b13796c0a8", "detail": {}}, "uuid": "c92714b8-f5f8-11ee-b8f3-df1fc2a006e0", "version": "0", "request": {"ipChain": [{"ip": "66.66.66.66", "geographicalContext": {"city": "Oakland", "state": "California", "country": "United States", "postalCode": "94602", "geolocation": {"lat": 37.8043, "lon": -122.2156}}, "version": "V4", "source": null}]}, "target": [{"id": "00ugb1l5ixnPE9vW45d7", "type": "User", "alternateId": "victim@gmail.com", "displayName": "SFA Test", "detailEntry": null}, {"id": "lae1uw7ldjDwKqw445d7", "type": "AuthenticatorEnrollment", "alternateId": "unknown", "displayName": "Password", "detailEntry": {"methodTypeUsed": "Password", "methodUsedVerifiedProperties": "[USER_PRESENCE]"}}]}
{"actor": {"id": "00ugb1l5ixnPE9vW45d7", "type": "User", "alternateId": "victim@gmail.com", "displayName": "SFA Test", "detailEntry": null}, "client": {"userAgent": {"rawUserAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36", "os": "Mac OS 13.6.6 (Ventura)", "browser": "CHROME"}, "zone": "null", "device": "Computer", "id": "okta.2b1959c8-bcc0-56eb-a589-cfcfb7422f26", "ipAddress": "66.66.66.66", "geographicalContext": {"city": "Oakland", "state": "California", "country": "United States", "postalCode": "94602", "geolocation": {"lat": 37.8043, "lon": -122.2156}}}, "device": null, "authenticationContext": {"authenticationProvider": null, "credentialProvider": null, "credentialType": null, "issuer": null, "interface": null, "authenticationStep": 0, "externalSessionId": "idxGM-KEyTOQAu6GexCkFOyUg"}, "displayMessage": "User single sign on to app", "eventType": "user.authentication.sso", "outcome": {"result": "SUCCESS", "reason": null}, "published": "2024-04-08T19:08:02.941Z", "securityContext": {"asNumber": 46375, "asOrg": "tonic.net  llc", "isp": "tonic telecom llc", "domain": "tonic.net", "isProxy": false}, "severity": "INFO", "debugContext": {"debugData": {"initiationType": "NA", "redirectUri": "https://dev-64597797.okta.com/enduser/callback", "requestId": "bb482f32f10b4b71cb7356a803c6ec04", "dtHash": "d6e78722080412af17efc0ed87ed848e2f1893527016b4425d29daf38500666d", "signOnMode": "OpenID Connect", "requestUri": "/oauth2/v1/token", "threatSuspected": "false", "url": "/oauth2/v1/token?"}}, "legacyEventType": "app.auth.sso", "transaction": {"type": "WEB", "id": "bb482f32f10b4b71cb7356a803c6ec04", "detail": {}}, "uuid": "52b6aaf6-f5db-11ee-aa69-2bc89aeb3dc5", "version": "0", "request": {"ipChain": [{"ip": "66.66.66.66", "geographicalContext": {"city": "Oakland", "state": "California", "country": "United States", "postalCode": "94602", "geolocation": {"lat": 37.8043, "lon": -122.2156}}, "version": "V4", "source": null}]}, "target": [{"id": "0oadu2s402mMhVgMC5d7", "type": "AppInstance", "alternateId": "Okta Dashboard", "displayName": "Okta Dashboard", "detailEntry": {"signOnModeType": "OPENID_CONNECT"}}, {"id": "0uagb1v0w4qKEPnc45d7", "type": "AppUser", "alternateId": "victim@gmail.com", "displayName": "SFA Test", "detailEntry": null}]}
{"actor": {"id": "00ugb1l5ixnPE9vW45d7", "type": "User", "alternateId": "victim@gmail.com", "displayName": "SFA Test", "detailEntry": null}, "client": {"userAgent": {"rawUserAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36", "os": "Mac OS 13.6.6 (Ventura)", "browser": "CHROME"}, "zone": "null", "device": "Computer", "id": null, "ipAddress": "66.66.66.66", "geographicalContext": {"city": "Oakland", "state": "California", "country": "United States", "postalCode": "94602", "geolocation": {"lat": 37.8043, "lon": -122.2156}}}, "device": null, "authenticationContext": {"authenticationProvider": null, "credentialProvider": null, "credentialType": null, "issuer": null, "interface": null, "authenticationStep": 0, "externalSessionId": "idxGM-KEyTOQAu6GexCkFOyUg"}, "displayMessage": "Verify user identity", "eventType": "user.authentication.verify", "outcome": {"result": "SUCCESS", "reason": null}, "published": "2024-04-08T19:08:01.592Z", "securityContext": {"asNumber": 46375, "asOrg": "tonic.net  llc", "isp": "tonic telecom llc", "domain": "tonic.net", "isProxy": false}, "severity": "INFO", "debugContext": {"debugData": {"authnRequestId": "0e8e72919c56be15d971ccf65e687340", "deviceFingerprint": "d4506d714e932f03e13f6a39a6933038", "requestId": "15514b3d163d2da7bb423d6e7ea0f698", "dtHash": "2dd4b992010c99faadf6278bab1c7a61e996a7bbf5f950ecaf35bd84b702acd0", "requestUri": "/idp/idx/identify", "threatSuspected": "false", "factorIntent": "LOGIN", "url": "/idp/idx/identify?"}}, "legacyEventType": null, "transaction": {"type": "WEB", "id": "15514b3d163d2da7bb423d6e7ea0f698", "detail": {}}, "uuid": "51e8d3f2-f5db-11ee-aecd-25e6f8ae02c1", "version": "0", "request": {"ipChain": [{"ip": "66.66.66.66", "geographicalContext": {"city": "Oakland", "state": "California", "country": "United States", "postalCode": "94602", "geolocation": {"lat": 37.8043, "lon": -122.2156}}, "version": "V4", "source": null}]}, "target": [{"id": "autdu3fv7qqAEADih5d7", "type": "AuthenticatorMethod", "alternateId": null, "displayName": "Password", "detailEntry": {"authenticatorKey": "okta_password", "authenticatorMethodVerificationTime": "2024-04-08T19:08:01.479Z", "methodTypeUsed": "password", "methodUsedVerifiedProperties": "[USER_PRESENCE]"}}, {"id": "0oadu2s402mMhVgMC5d7", "type": "AppInstance", "alternateId": null, "displayName": "Okta Dashboard", "detailEntry": null}]}
{"actor": {"id": "00ugb1l5ixnPE9vW45d7", "type": "User", "alternateId": "victim@gmail.com", "displayName": "SFA Test", "detailEntry": null}, "client": {"userAgent": {"rawUserAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36", "os": "Mac OS 13.6.6 (Ventura)", "browser": "CHROME"}, "zone": "null", "device": "Computer", "id": null, "ipAddress": "66.66.66.66", "geographicalContext": {"city": "Oakland", "state": "California", "country": "United States", "postalCode": "94602", "geolocation": {"lat": 37.8043, "lon": -122.2156}}}, "device": null, "authenticationContext": {"authenticationProvider": null, "credentialProvider": null, "credentialType": null, "issuer": null, "interface": null, "authenticationStep": 0, "externalSessionId": "idxGM-KEyTOQAu6GexCkFOyUg"}, "displayMessage": "User login to Okta", "eventType": "user.session.start", "outcome": {"result": "SUCCESS", "reason": null}, "published": "2024-04-08T19:08:01.522Z", "securityContext": {"asNumber": 46375, "asOrg": "tonic.net  llc", "isp": "tonic telecom llc", "domain": "tonic.net", "isProxy": false}, "severity": "INFO", "debugContext": {"debugData": {"authnRequestId": "0e8e72919c56be15d971ccf65e687340", "deviceFingerprint": "d4506d714e932f03e13f6a39a6933038", "oktaUserAgentExtended": "okta-auth-js/7.0.1 okta-signin-widget-7.16.2", "requestId": "15514b3d163d2da7bb423d6e7ea0f698", "dtHash": "2dd4b992010c99faadf6278bab1c7a61e996a7bbf5f950ecaf35bd84b702acd0", "origin": "https://dev-64597797.okta.com", "requestUri": "/idp/idx/identify", "threatSuspected": "false", "url": "/idp/idx/identify?"}}, "legacyEventType": "core.user_auth.login_success", "transaction": {"type": "WEB", "id": "15514b3d163d2da7bb423d6e7ea0f698", "detail": {}}, "uuid": "51de257e-f5db-11ee-aecd-25e6f8ae02c1", "version": "0", "request": {"ipChain": [{"ip": "66.66.66.66", "geographicalContext": {"city": "Oakland", "state": "California", "country": "United States", "postalCode": "94602", "geolocation": {"lat": 37.8043, "lon": -122.2156}}, "version": "V4", "source": null}]}, "target": [{"id": "lae1uw7ldjDwKqw445d7", "type": "AuthenticatorEnrollment", "alternateId": "unknown", "displayName": "Password", "detailEntry": null}, {"id": "0oadu2s402mMhVgMC5d7", "type": "AppInstance", "alternateId": "Okta Dashboard", "displayName": "Okta Dashboard", "detailEntry": null}]}
{"actor": {"id": "00ugb1l5ixnPE9vW45d7", "type": "User", "alternateId": "victim@gmail.com", "displayName": "SFA Test", "detailEntry": null}, "client": {"userAgent": {"rawUserAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36", "os": "Mac OS 13.6.6 (Ventura)", "browser": "CHROME"}, "zone": "null", "device": "Computer", "id": null, "ipAddress": "66.66.66.66", "geographicalContext": {"city": "Oakland", "state": "California", "country": "United States", "postalCode": "94602", "geolocation": {"lat": 37.8043, "lon": -122.2156}}}, "device": null, "authenticationContext": {"authenticationProvider": null, "credentialProvider": null, "credentialType": null, "issuer": null, "interface": null, "authenticationStep": 0, "externalSessionId": "idxGM-KEyTOQAu6GexCkFOyUg"}, "displayMessage": "Evaluation of sign-on policy", "eventType": "policy.evaluate_sign_on", "outcome": {"result": "ALLOW", "reason": "Sign-on policy evaluation resulted in AUTHENTICATED"}, "published": "2024-04-08T19:08:01.516Z", "securityContext": {"asNumber": 46375, "asOrg": "tonic.net  llc", "isp": "tonic telecom llc", "domain": "tonic.net", "isProxy": false}, "severity": "INFO", "debugContext": {"debugData": {"authnRequestId": "0e8e72919c56be15d971ccf65e687340", "deviceFingerprint": "d4506d714e932f03e13f6a39a6933038", "oktaUserAgentExtended": "okta-auth-js/7.0.1 okta-signin-widget-7.16.2", "requestId": "15514b3d163d2da7bb423d6e7ea0f698", "authMethodFirstVerificationTime": "2024-04-08T19:08:01.479Z", "dtHash": "2dd4b992010c99faadf6278bab1c7a61e996a7bbf5f950ecaf35bd84b702acd0", "authMethodFirstType": "okta_password:password:autdu3fv7qqAEADih5d7", "authMethodFirstEnrollment": "lae1uw7ldjDwKqw445d7", "requestUri": "/idp/idx/identify", "threatSuspected": "false", "url": "/idp/idx/identify?"}}, "legacyEventType": null, "transaction": {"type": "WEB", "id": "15514b3d163d2da7bb423d6e7ea0f698", "detail": {}}, "uuid": "51dd3b1c-f5db-11ee-aecd-25e6f8ae02c1", "version": "0", "request": {"ipChain": [{"ip": "66.66.66.66", "geographicalContext": {"city": "Oakland", "state": "California", "country": "United States", "postalCode": "94602", "geolocation": {"lat": 37.8043, "lon": -122.2156}}, "version": "V4", "source": null}]}, "target": [{"id": "0oadu2s402mMhVgMC5d7", "type": "AppInstance", "alternateId": "Okta Dashboard", "displayName": "Okta Dashboard", "detailEntry": {"signOnModeType": "OPENID_CONNECT", "signOnModeEvaluationResult": "AUTHENTICATED"}}, {"id": "0prdu2nzoziFfmflf5d7", "type": "Rule", "alternateId": "unknown", "displayName": "Default Rule", "detailEntry": {"policyRuleFactorMode": "1FA"}}, {"id": "rulgb1wr2ds0nB2Ds5d7", "type": "Rule", "alternateId": "unknown", "displayName": "sfa", "detailEntry": {"policyRuleFactorMode": "1FA"}}]}